The Virus Component:
The virus is first decoded and then executed. It searches for active components of the following antivirus programs:
AntiViral Toolkit Pro
AVP Monitor
Vsstat
Webscanx
Avconsol
McAfee VirusScan
Vshwin32
Central do McAffee VirusScan
If it can find one of the above components, the virus is not activated!

Then, the virus decompresses its components and installs them in Windows directory. The following files are created:

The worm uses the file WSOCK32.DLL in Windows directory, adding parts of its code at the end of the file and a send command. Thus, the worm controls all emails sent from the infected system.
If WSOCK32.DLL is already in use and the worm can not add its code to it, then the worm creates a copy of this file, named WSOCK32.MTX, infects it and using an entry in WININIT.INI, replaces the original WSOCK32.DLL file with the infected WSOCK32.MTX:

It enters a new registry key:
HKLM\Software\[MATRIX]
If the key is already made, the installation is skipped. If not, the backdoor is registered for the Auto Run Section: HKLM\Software\Microsoft\Windows\CurrentVersion\RunSystemBackup=%WinDir%\MTX_.EXE